@zhongqian97-code/ecode 0.3.6 → 0.3.8

package/dist/index.js

@@ -38,7 +38,11 @@ var MODEL_CONTEXT_LIMITS = {
   "claude-haiku-4-5-20251001": 2e5,
   // DeepSeek 系列（上下文较小，截断策略需更激进）
   "deepseek-chat": 65536,
-  "deepseek-reasoner": 65536
+  "deepseek-reasoner": 65536,
+  // MiniMax 系列（baseUrl: https://api.minimax.chat/v1）
+  "MiniMax-M2.5": 1e6,
+  "MiniMax-M2.5-highspeed": 192e3,
+  "MiniMax-Text-01": 1e6
 };
 var DEFAULT_CONTEXT_LIMIT = 128e3;
 function getContextLimit(model, override) {
@@ -159,6 +163,7 @@ function createOpenAIProvider(profile) {
           );
           const tcAccumulator = /* @__PURE__ */ new Map();
           let reasoningAccumulator = "";
+          const reasoningDetailsAcc = /* @__PURE__ */ new Map();
           for await (const chunk of response) {
             const choice = chunk.choices[0];
             if (!choice) continue;
@@ -166,6 +171,26 @@ function createOpenAIProvider(profile) {
             if (delta.reasoning_content) {
               reasoningAccumulator += delta.reasoning_content;
             }
+            if (delta.reasoning_details && delta.reasoning_details.length > 0) {
+              for (const rd of delta.reasoning_details) {
+                const id = rd.id ?? "";
+                const text = rd.text ?? "";
+                if (!reasoningDetailsAcc.has(id)) {
+                  reasoningDetailsAcc.set(id, {
+                    type: rd.type ?? "reasoning.text",
+                    id,
+                    format: rd.format ?? "",
+                    index: rd.index ?? 0,
+                    text: ""
+                  });
+                }
+                const existing = reasoningDetailsAcc.get(id);
+                existing.text += text;
+                if (!delta.reasoning_content && text) {
+                  reasoningAccumulator += text;
+                }
+              }
+            }
             if (delta.tool_calls) {
               for (const tc of delta.tool_calls) {
                 if (!tcAccumulator.has(tc.index)) {
@@ -192,6 +217,8 @@ function createOpenAIProvider(profile) {
                 // 让调用方用 if (chunk.toolCalls) 做简洁判断
                 toolCalls: tcAccumulator.size > 0 ? Array.from(tcAccumulator.values()) : void 0,
                 reasoning: reasoningAccumulator || void 0,
+                // reasoningDetails 仅在流中出现过结构化推理时返回（MiniMax 兼容）
+                reasoningDetails: reasoningDetailsAcc.size > 0 ? Array.from(reasoningDetailsAcc.values()) : void 0,
                 // 将 snake_case 的原始字段映射为 camelCase，对外接口保持一致
                 usage: rawUsage ? {
                   promptTokens: rawUsage.prompt_tokens,
@@ -200,9 +227,10 @@ function createOpenAIProvider(profile) {
                 } : void 0
               };
             } else {
+              const incrementalReasoning = delta.reasoning_content ?? (delta.reasoning_details && delta.reasoning_details.length > 0 ? delta.reasoning_details.map((rd) => rd.text ?? "").join("") : void 0);
               yield {
                 text: delta.content ?? "",
-                reasoning: delta.reasoning_content,
+                reasoning: incrementalReasoning,
                 done: false
               };
             }
@@ -258,8 +286,9 @@ var ALLOWLIST = [
   "date",
   "whoami",
   "which",
-  "env",
   "printenv"
+  // "env" 故意排除：env <CMD> 会执行任意子命令，不适合 allow 级别。
+  // 仅显示环境变量的 printenv 保留在白名单。
 ];
 var DEFAULT_DANGER_LIST = [
   "rm -rf",
@@ -284,7 +313,10 @@ var INDIRECT_EXEC_LIST = [
   "python3 -c",
   "node -e",
   "perl -e",
-  "ruby -e"
+  "ruby -e",
+  // eval 执行任意字符串作为 shell 命令，无论 payload 内容如何都视为危险。
+  // 与 xargs/python -c 的性质相同：执行能力本身就是风险。
+  "eval"
 ];
 function hasFindExec(cmd) {
   return /^find(\s|$)/.test(cmd) && /\s-exec(\s|$)/.test(cmd);
@@ -348,22 +380,70 @@ function splitByControlOps(cmd) {
 }
 function stripShellWrapper(cmd) {
   const trimmed = cmd.trim();
-  const dq = trimmed.match(/^(?:bash|sh)\s+-c\s+"((?:[^"\\]|\\.)*)"/);
-  if (dq) return dq[1];
-  const sq = trimmed.match(/^(?:bash|sh)\s+-c\s+'([^']*)'/);
-  if (sq) return sq[1];
-  const nq = trimmed.match(/^(?:bash|sh)\s+-c\s+(\S+)/);
-  if (nq) return nq[1];
+  const shellMatch = trimmed.match(/^(bash|sh)\s+([\s\S]*)/);
+  if (!shellMatch) return trimmed;
+  let rest = shellMatch[2];
+  let hasCFlag = false;
+  while (rest.length > 0) {
+    const flagMatch = rest.match(/^(-\w+)\s*([\s\S]*)/);
+    if (!flagMatch) break;
+    const flag = flagMatch[1];
+    rest = flagMatch[2];
+    if (flag.includes("c")) {
+      hasCFlag = true;
+      rest = rest.trimStart();
+      break;
+    }
+    rest = rest.trimStart();
+  }
+  if (!hasCFlag || !rest.length) return trimmed;
+  if (rest.startsWith('"')) {
+    const m = rest.match(/^"((?:[^"\\]|\\.)*)"/);
+    if (m) return m[1];
+  } else if (rest.startsWith("'")) {
+    const m = rest.match(/^'([^']*)'/);
+    if (m) return m[1];
+  } else {
+    const m = rest.match(/^(\S+)/);
+    if (m) return m[1];
+  }
+  return trimmed;
+}
+function stripEnvWrapper(cmd) {
+  const trimmed = cmd.trim();
+  if (!trimmed.startsWith("env ") && trimmed !== "env") return trimmed;
+  let rest = trimmed.slice(3).trimStart();
+  while (rest.length > 0) {
+    const assignMatch = rest.match(/^(\w+=\S*)\s*([\s\S]*)/);
+    if (!assignMatch) break;
+    rest = assignMatch[2].trimStart();
+  }
+  if (!rest.length) return trimmed;
+  return rest;
+}
+function stripCommandWrapper(cmd) {
+  const trimmed = cmd.trim();
+  const m = trimmed.match(/^command\s+([\s\S]+)/);
+  if (m) return m[1].trimStart();
   return trimmed;
 }
 function classifyCommand(cmd, dangerPatterns, _depth = 0) {
   const trimmed = cmd.trim();
   const patterns = dangerPatterns ?? DEFAULT_DANGER_LIST;
   if (_depth < 5) {
-    const inner = stripShellWrapper(trimmed);
-    if (inner !== trimmed) {
-      const innerClass = classifyCommand(inner.trim(), dangerPatterns, _depth + 1);
-      if (innerClass === "danger") return "danger";
+    const shellInner = stripShellWrapper(trimmed);
+    if (shellInner !== trimmed) {
+      if (classifyCommand(shellInner.trim(), dangerPatterns, _depth + 1) === "danger") return "danger";
+      return "normal";
+    }
+    const envInner = stripEnvWrapper(trimmed);
+    if (envInner !== trimmed) {
+      if (classifyCommand(envInner.trim(), dangerPatterns, _depth + 1) === "danger") return "danger";
+      return "normal";
+    }
+    const commandInner = stripCommandWrapper(trimmed);
+    if (commandInner !== trimmed) {
+      if (classifyCommand(commandInner.trim(), dangerPatterns, _depth + 1) === "danger") return "danger";
       return "normal";
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhongqian97-code/ecode",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "A minimal Claude Code clone with REPL interface and bash tool calling",
   "type": "module",
   "author": "zhongqian97-code",